Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials

Ravie LakshmananSep 02, 2026Vulnerability / Network Security

Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated remote code execution.

The vulnerability in question is CVE-2026-9586 (CVSS score: 9.3), a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997) that can allow attackers to remotely execute arbitrary code as the PostgreSQL superuser without credentials. Sangoma released patches for the flaw in Switchvox 8.4.0.2 on July 14, 2026.

"An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization," according to a description of the flaw on CVE.org.

"An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution."

Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials

Other newsrooms on this story

Related reading

Hackers exploit Sangoma Switchvox flaw to deploy reverse shells

Sangoma Switchvox Vulnerability Exploited in the Wild

Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands

Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain

Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication

Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw